Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
- ID
- 18050
- Status
- summarized
- Published
- 26 Aug 2026, 3:12 PM
- Fetched
- 26 Aug 2026, 5:28 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 2.5
- Created
- 26 Aug 2026, 5:29 PM
- Tags
- Audience
- developers
What happened
An independent malware researcher documented SLEEPWALKER, a 59,904-byte unsigned Windows DLL that side-loads into ESET Management Agent by impersonating Microsoft's dpapi.dll. It stays inert in memory until a specifically crafted network packet arrives, then executes commands written in a custom 23-instruction bytecode language, with no embedded IOCs and no outbound connections. The single sample has no known victims, attribution, or confirmed deployment.
Why it matters
This is a post-compromise implant requiring existing admin access, not an entry vector—so it won't change how most builders secure their systems. The DLL side-loading technique (impersonating dpapi.dll in the ESET Management Agent directory) is worth noting if you run ESET Management Agent on Windows infrastructure, but the article provides no evidence of active deployment.
Discussion angle
The custom 23-instruction bytecode VM and trigger-by-promiscuous-packet design is a notable tradecraft detail—worth a brief mention as an example of how sophisticated post-compromise implants evade IOC-based detection, but not actionable for most builders.